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CLAIMS 

1. A cryptographic calculation method 
characterised in that, in order to execute a block of 
instructions (rij) chosen as a function of an input 

5 variable (Di) from amongst N predefined blocks of 
instructions (IIi, n N ) / a block (r(k,s)) common to the 
N predefined blocks of instruct ions (Oi # ... , On) is 
executed a predefined number (Lj) of times, and the 
predefined number (Lj) being associated with the chosen 
10 block of instructions (Oj ) . 

2. A method according to Claim 1, in which the 
predefined number (Lj) is variable from one predefined 
block of instructions (111, n N ) to another. 

3. A method according to one of Claims 1 to 2 , 
15 in which the common block (T(k,s)) comprises at least 

one calculation instruction (yk) equivalent , vis-a-vis a 
covert channel attack, to a calculation instruction of 
each predefined block (111, n N ) . 

4. A method according to Claim 3, in which the 
20 common block (T(k,s)) also comprises an instruction to 

update a loop pointer (k) indicating a number of 
executions already executed of the common elementary 
block (r(k,s) ) . 

5. A method according to Claim 3 or Claim 4, in 

v 

25 which the common block (T(k,s)) also comprises an 
instruction to update a state pointer (s) indicating 
whether the predefined number (LjO has been reached. 

6. A method according to Claim 4 or Claim 5, in 
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which the value of the loop pointer (k) and/or the 
value of the state pointer (s) are a function of the 
value of the input variable (Di) and/or of the number of 
instructions of the block of instructions (Pj) 
5 associated with the input data value. 

7. A method according to one of Claims 1 to 6, 
in which, in order to successively effect several 
blocks of instructions chosen from amongst the N 
predefined blocks of instructions (Eli, n N ) , each 

10 chosen block of instructions (llj) being selected as a 

function of an input variable (Di) associated with an 

input index (i) , 

the common elementary block (r(k,s)) is executed 

a total number (L T ) of times, the total number (L T ) 
15 being equal to a sum of the predefined numbers (Lj) 

associated with each chosen block of instructions (llj) . 

8. A method according to Claim 7, during which 
one and the same block of instructions may be chosen 
several times according to the input variable 

2 0 associated with the input index (i) . 

9. A method according to one of Claims 7 or 8, 
in which the value of the loop pointer (k) and/or the 
value of the state pointer (s) and/or the value of the 
input variable (Di) and/or the number of instructions of 

25 the block of instructions (llj) associated with the 
value of the input data item (Di) are linked by one or 
more mathematical functions. 

10. A method according to Claim 9, used in the 
implementation of an exponentiation calculation of the 
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type B = A D , D being an integer number of M bits, each 
bit (Di) of D corresponding to an input variable of input 
index i, the method comprising the following steps: 

Initialisation : 

R 0 <- 1; Ri <- A; i <- M-l 
As long as i > 0, repeat the common block T(k / s) : 
k <- (/s)x(k+l) + sx2x(/D ± ) 
s <- (k mod 2) + (k div 2) 
Y(k,s) : R 0 <- R 0 xR k mod 2 

i <- i - s 

Return R 0 . 

11. A method according to Claim 9, used in the 
implementation of an exponentiation calculation of the 
type B = A D , D being an integer number of M bits, each 

15 bit (D±) of D corresponding to an input variable of input 
index i, the method comprising the following steps: 

Initialisation: 

R 0 <- 1; Ri <- A; i <- M-l; k <- 1 
As long as i > 0 , repeat the common block T' (k,s) : 
20 k <- (Di) AND (/k) 

y' (s,k) : R 0 <- R 0 xR k 

i <- i - </k) 

Return R 0 . 

12. A method according to Claim 9, used in the 
25 implementation of an exponentiation calculation of the 

type B = A D , D being an integer number of M bits, each 
bit (Di) of D corresponding to an input variable of input 
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index i, the method comprising the following steps: 

Initialisation : 

R 0 <- 1; Ri <- A; i <- 0; k <- 1 
As long as i < M-l, repeat the block r(k,s) : 
5 k <- k 0 Di 

y(k) : R k <- R k xR x 
i <- i+k 

Return R 0 . 

13. A method according to Claim 9, used in the 
10 implementation of an exponentiation calculation of the 

type B = A D , D being an integer number of M bits, each 
bit (Di) of D corresponding to an input variable of input 
index i, the method comprising the following steps: 

Initialisation : 

R 0 <- 1; Ri <- A, ; R 2 <- A 3 ; 
D_! <- 0; i <- M-l; S <- 1 
As long as i > 0, repeat the block T(k,s) : 

k <- (/s)x(k+l) + sx(Di + 2x(Di AND Di_i) ) 
s <- /((k mod 2) 0 (k div 4)) 

y(k,s) : R 0 <- RoxR SX (k div 2) 

i < - i - sx ( k mod 2 + 1 ) 

Return R 0 . 

14. A method according to Claim 9, used in the 
implementation of an. exponentiation calculation of the 

25 type B = A D , D being an integer number of M bits, each 
bit (Di) of D corresponding to an input variable of input 
index i, the method comprising the following steps: 



15 



20 



40 



Initialisation : 

R 0 <- 1; Ri <- A; R 2 <- A 3 ; 
D_i <- 0; i <- M-l; s <- 1 
As long as i > 0, repeat: 
5 k <- (/s)x(k+l) 

s <- s © Di © ( (Di-i AND (k mod 2)) 

r(k,s) : R 0 <- R 0 xR kxs 

i <- i - kxs - (/Di) 

Return R 0 . 

15. A method according to one of Claims 7 or 8 , 
in which the links between the value of the loop 
pointer (k) and/or the value of the state pointer (s) 
and/or the value of the input variable (Di) and/or the 
number of instructions of the block of instructions 
(llj) associated with the value of the input data item 
(Di) are defined by a table with several inputs such as 
a matrix (U(k,l)). 

16. A method according to Claim 15, used in the 
implementation of an exponentiation calculation of the 
type B = A D , D being an integer number of M bits, each 
bit (Di) of D corresponding to an input variable of input 
index i, the method comprising the following step: 

As long as i > 0, repeat the block T(k,s) : 
k <- (/s)x(k+l) + sx2x(/Di) 
25 s <- U(k, 1) 

y(k,s): R 0 <- R 0 xRu(k,o) 

i <- i - s 
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where (U(k,l)) is the following matrix: 



(U(k,l)) 



0 < k < 2 = 
0 < 1 < 1 



0 0 

1 1 



0 1 

v J 



17. A method according to Claim 15 , used in the 
implementation of an exponentiation calculation of the 
type B = A D according to the algorithm (M, M 3 ) , D being 
an integer number of M bits, each bit (Di) of D 
corresponding to an input variable of input index i, 
the method comprising the following step: 
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As long as i > 0, repeat the common block r(k,s) 
k <- (/s)x(k+l) + sx(D ± + 2x(/Di AND Di-x) ) 
s <- U(k,2) 

y(k,s): R 0 <- R 0 xR u(k ,o); 

i <- i - U(k, 1) 



where (U(k,l)) is the following matrix: 
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(U(k,l) ) 



0 < k < 5 
0 < 1 < 2 



0 1 1 

0 0 0 

1 1 I 
0 0 0 
0 0 0 

2 2 1 
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18. A method according to Claim 15, used in the 
implementation of a calculation on an elliptic curve in 
affine coordinates, a calculation using operations of 
the addition or doubling of points type, and in which 
the following step is performed: 
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As long as i > 0, repeat r(k,s): 
y(k) : Ru<k,o) <- Ri + R3 ; 

Ru(k # l) <" Ru(k,l) + Ru(k,2)#" 

R 5 <- R 2 /Ri; Ru<k,3) <- Ri + R 5 ; 
5 Ru(k,4) <- R5 2 ; 

Ru(k,4) <" Ru(k,4) +a; 
Ri < - Ri + Ru(k,5) ; 

R2 <- Ri + Ru(k,6); Rg <- Ri + Ru(k,7>; 

R 5 <- R 5 . R 6 ; R 2 <- R 2 + R 5 
10 s<-k-Di+l 

k <- (k+1) x (/s) ; 
i <- i - s; 

where (U(k # l)) is the following matrix: 



(U(k, 1) ) 0 " k " 1 " 
0 < 1 < 10 



f \ 2 4 1 6 6 4 3^ 
6 6 3 5 1 5 2 6 



15 19. A method for obtaining an elementary block 

(r(k,s)) common to N predefined blocks of instructions 
(lli, n N ) , a method able to be used for implementing a 
cryptographic calculation method according to one of 
Claims 1 to 12, the method being characterised in that 

20 it comprises the following steps: 

El: breaking down each predefined block of 
instructions (FIi, n N ) into a series of elementary 

blocks (y) equivalent vis-a-vis a covert channel attack, 
and classifying all the elementary blocks, 

25 E2 : seeking a common elementary block (y(k,s)) 

equivalent to all the elementary blocks (y) of all the 
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predefined blocks of instructions, 

E3 : seeking a common block (T(k / s)) comprising at 
least the common elementary block (y(k,s)) previously- 
obtained and an instruction to update a loop pointer 
5 (k) such that an execution of the common elementary 
block associated with the value of the loop pointer (k) 
and an execution of the elementary block with a rank 
equal to the value of the loop pointer (k) are 
identical . 

10 20. A method according to Claim 19, 

characterised in that, during step El, at least one 
fictional instruction is added to at least one 
predefined block of instructions. 

15 



